* vpm: validate registry TLS, check returned identity, skip client setup for serve
Three review findings on the registry transport, each with a test.
Registry requests over HTTPS now validate certificates, whether or not
they carry a token; tokenless metadata was previously fetched with
validation off, so a MITM could replace it. Plain HTTP and non-registry
traffic are unchanged.
decode_registry_module now checks the body against the requested route: a
body naming another module, or another version when one was requested, is
refused instead of decoded. A cross-wired registry previously flowed into
resolution output.
v registry serve no longer requires a writable VModules home. Dispatch runs
before ensure_vmodules_dir_exist, and init_settings skips the log-cache
setup for the registry command, so a service account can serve a registry
from its working directory.
* vpm: refuse world-readable signing keys, never assert SBOM license conclusions
Two Codex review findings on the registry, each with a test.
A signing key file readable by group or others lets any local user forge
signatures, so it is no longer loaded. The check is Unix-only by design:
Windows has no equivalent mode check and accepts the file there, while a
missing file is refused everywhere. A refused key serves unsigned, exactly
like a missing one, which verification already fails closed on.
`licenseConcluded` is a derived result and nothing here derives one, so it
is now always NOASSERTION. The publisher's declaration stays in
`licenseDeclared`. Consumers previously read an unexamined claim as a
compliance result.
Mahdi ramezaan zaade
182ebde118